Merge "[POLICY] Remove hardcoded credentials from policy-api"

diff --git a/kubernetes/appc/resources/config/log/filebeat/log4j/filebeat.yml b/kubernetes/appc/resources/config/log/filebeat/filebeat.yml
similarity index 100%
rename from kubernetes/appc/resources/config/log/filebeat/log4j/filebeat.yml
rename to kubernetes/appc/resources/config/log/filebeat/filebeat.yml

diff --git a/kubernetes/appc/templates/configmap.yaml b/kubernetes/appc/templates/configmap.yaml
index 72dc617..fe206a9 100644 (file)
--- a/kubernetes/appc/templates/configmap.yaml
+++ b/kubernetes/appc/templates/configmap.yaml
@@ -118,19 +118,6 @@ data:
 ---
 apiVersion: v1
 kind: ConfigMap
-metadata:
-  name: {{ include "common.fullname" . }}-filebeat
-  namespace: {{ include "common.namespace" . }}
-  labels:
-    app: {{ include "common.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" . }}
-    heritage: {{ .Release.Service }}
-data:
-{{ tpl (.Files.Glob "resources/config/log/filebeat/log4j/*").AsConfig . | indent 2 }}
----
-apiVersion: v1
-kind: ConfigMap
 metadata:
   name: {{ include "common.fullname" . }}-logging-cfg
   namespace: {{ include "common.namespace" . }}
@@ -141,3 +128,5 @@ metadata:
     heritage: {{ .Release.Service }}
 data:
 {{ tpl (.Files.Glob "resources/config/log/*").AsConfig . | indent 2 }}
+
+{{ include "common.log.configMap" . }}

diff --git a/kubernetes/appc/templates/statefulset.yaml b/kubernetes/appc/templates/statefulset.yaml
index 5fd34ec..3480e63 100644 (file)
--- a/kubernetes/appc/templates/statefulset.yaml
+++ b/kubernetes/appc/templates/statefulset.yaml
@@ -185,7 +185,7 @@ spec:
             subPath: installSdncDb.sh
           - mountPath: {{ .Values.persistence.mdsalPath }}
             name: {{ include "common.fullname" . }}-data
-          - mountPath: /var/log/onap
+          - mountPath: {{ .Values.log.path }}
             name: logs
           - mountPath: /opt/onap/appc/data/org.ops4j.pax.logging.cfg
             name: log-config
@@ -208,17 +208,7 @@ spec:
         {{- end }}
 
         # side car containers
-        - name: filebeat-onap
-          image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
-          imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
-          volumeMounts:
-          - mountPath: /usr/share/filebeat/filebeat.yml
-            name: filebeat-conf
-            subPath: filebeat.yml
-          - mountPath: /var/log/onap
-            name: logs
-          - mountPath: /usr/share/filebeat/data
-            name: data-filebeat
+        {{ include "common.log.sidecar" . | nindent 8 }}
       volumes:
         - name: keyfile-certs
           secret:
@@ -229,16 +219,12 @@ spec:
         - name: localtime
           hostPath:
             path: /etc/localtime
-        - name: filebeat-conf
-          configMap:
-            name: {{ include "common.fullname" . }}-filebeat
         - name: log-config
           configMap:
             name: {{ include "common.fullname" . }}-logging-cfg
         - name: logs
           emptyDir: {}
-        - name: data-filebeat
-          emptyDir: {}
+        {{ include "common.log.volumes" . | nindent 8 }}
         - name: onap-appc-data-properties-input
           configMap:
             name: {{ include "common.fullname" . }}-onap-appc-data-properties

diff --git a/kubernetes/appc/values.yaml b/kubernetes/appc/values.yaml
index fb8230b..cde8920 100644 (file)
--- a/kubernetes/appc/values.yaml
+++ b/kubernetes/appc/values.yaml
@@ -20,6 +20,7 @@ global:
   nodePortPrefix: 302
   readinessRepository: oomk8s
   readinessImage: readiness-check:2.0.0
+  centralizedLoggingEnabled: false
   loggingRepository: docker.elastic.co
   loggingImage: beats/filebeat:5.5.0
   # envsusbt
@@ -62,6 +63,10 @@ pullPolicy: Always
 # flag to enable debugging - application support required
 debugEnabled: false
 
+# log configuration
+log:
+  path: /var/log/onap
+
 # application configuration
 config:
 #  dbRootPassExternalSecret: some secret

diff --git a/kubernetes/common/common/templates/_log.tpl b/kubernetes/common/common/templates/_log.tpl
new file mode 100644 (file)
index 0000000..3ae536a
--- /dev/null
+++ b/kubernetes/common/common/templates/_log.tpl
@@ -0,0 +1,53 @@
+{{/*
+# Copyright © 2020 Orange
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+*/}}
+
+{{- define "common.log.sidecar" -}}
+{{- if .Values.global.centralizedLoggingEnabled }}
+- name: {{ include "common.name" . }}-filebeat
+  image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
+  imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
+  volumeMounts:
+  - name: filebeat-conf
+    mountPath: /usr/share/filebeat/filebeat.yml
+    subPath: filebeat.yml
+  - name: logs
+    mountPath: {{ .Values.log.path }}
+  - name: filebeat-data
+    mountPath: /usr/share/filebeat/data
+{{- end -}}
+{{- end -}}
+
+{{- define "common.log.volumes" -}}
+{{- if .Values.global.centralizedLoggingEnabled }}
+- name: filebeat-conf
+  configMap:
+    name: {{ include "common.fullname" . }}-filebeat
+- name: filebeat-data
+  emptyDir: {}
+{{- end -}}
+{{- end -}}
+
+{{- define "common.log.configMap" -}}
+{{- if .Values.global.centralizedLoggingEnabled }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata: {{- include "common.resourceMetadata" (dict "dot" . "suffix" "filebeat") | nindent 2 }}
+data:
+{{ tpl (.Files.Glob "resources/config/log/filebeat/*").AsConfig . | indent 2 }}
+{{- end }}
+{{- end -}}
+

diff --git a/kubernetes/onap/resources/overrides/onap-all-ingress-nginx-vhost.yaml b/kubernetes/onap/resources/overrides/onap-all-ingress-nginx-vhost.yaml
index 887bfc7..4283a0d 100644 (file)
--- a/kubernetes/onap/resources/overrides/onap-all-ingress-nginx-vhost.yaml
+++ b/kubernetes/onap/resources/overrides/onap-all-ingress-nginx-vhost.yaml
@@ -54,8 +54,6 @@ nbi:
   enabled: true
 policy:
   enabled: true
-pomba:
-  enabled: true
 portal:
   enabled: true
 robot:

diff --git a/kubernetes/onap/resources/overrides/onap-all.yaml b/kubernetes/onap/resources/overrides/onap-all.yaml
index d2fb183..570a088 100644 (file)
--- a/kubernetes/onap/resources/overrides/onap-all.yaml
+++ b/kubernetes/onap/resources/overrides/onap-all.yaml
@@ -17,6 +17,7 @@
 ###################################################################
 global:
   addTestingComponents: &testing true
+  centralizedLoggingEnabled: &centralizedLogging false
 cassandra:
   enabled: true
 mariadb-galera:
@@ -60,8 +61,6 @@ nbi:
   enabled: true
 policy:
   enabled: true
-pomba:
-  enabled: true
 portal:
   enabled: true
 robot:

diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml
index 6233394..5839add 100755 (executable)
--- a/kubernetes/onap/values.yaml
+++ b/kubernetes/onap/values.yaml
@@ -103,6 +103,11 @@ global:
   # if set this element will force or not tls even if serviceMesh.tls is set.
   # tlsEnabled: false
 
+  # Logging
+  # Currently, centralized logging is not in best shape so it's disabled by
+  # default
+  centralizedLoggingEnabled: &centralizedLogging false
+
 
 # Example of specific for the components where you want to disable TLS only for
 # it:
@@ -180,8 +185,11 @@ dmaap:
   enabled: false
 esr:
   enabled: false
+# Today, "logging" chart that perform the central part of logging must also be
+# enabled in order to make it work. So `logging.enabled` must have the same
+# value than centralizedLoggingEnabled
 log:
-  enabled: false
+  enabled: *centralizedLogging
 sniro-emulator:
   enabled: false
 oof: